Microsoft Threat Intelligence

@MsftSecIntel

We are Microsoft's global network of security experts. Follow for security research and threat intelligence.

Redmond, WA

aka.ms/threatintelblog

Replies Reposts Media

Microsoft Threat Intelligence
@MsftSecIntel
1h
The September 2026 security updates are available. In addition, starting today, Microsoft is publishing Vulnerability Exploitability eXchange (VEX) statements for all Microsoft-assigned CVEs. Learn more: msft.it/6012aXv5M
Microsoft Security Response Center
@msftsecresponse
1h
Security updates for September are now available: msft.it/6018SZEg0. Alongside this month's release, we're expanding machine-readable Vulnerability Exploitability eXchange (VEX) coverage to all Microsoft-assigned CVEs, providing customers with more consistent,
1
Microsoft Threat Intelligence
@MsftSecIntel
Sep 3
Microsoft Security Researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized by AI prompt injection research as ASCII smuggling, to obscure financial lure words before email filters parsed them.
ASCII smuggling crosses over from AI prompt injection to phishing evasion | Microsoft Security Blog
From microsoft.com
9
Microsoft Threat Intelligence
@MsftSecIntel
Sep 2
Microsoft Threat Intelligence is tracking a human-operated intrusion campaign in which attackers are impersonating IT personnel & abusing external Teams collaboration to gain remote access and deploy a Node.js implant for persistent command execution & C2.
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access |...
From microsoft.com
3
Microsoft Threat Intelligence
@MsftSecIntel
Sep 1
Microsoft Defender Experts is tracking a malware campaign that uses counterfeit software-download sites impersonating trusted vendors and dynamically generated installer archives to deliver multistage payloads leading to system compromise. msft.it/6011aTt3H Once executed,
Counterfeit installers to system compromise: Tracking a deceptive software download campaign |...
From microsoft.com
2
Microsoft Threat Intelligence
@MsftSecIntel
Aug 28
Microsoft Security Research is investigating a TerminalFix campaign, a variant of the ClickFix technique, that leads to a reverse-tunnel implant capable of providing network-level proxy access through a compromised host. This TerminalFix campaign uses fake CAPTCHA verification
3